On July 15, FINTRAC published an updated advisory on financial transactions related to countries identified by the Financial Action Task Force, following the FATF's June 2026 statements. Most dealerships and leasing companies will file this under "bank news" and move on. That's a mistake, for one specific reason: your compliance program must include a documented risk assessment covering clients, products, delivery channels and geography, and this advisory is FINTRAC's own statement of what geography risk currently looks like.

What the July update says, in brief:

  • Three countries stay in the highest tier (the FATF's "call for action"): North Korea, Iran and Myanmar. Transactions originating from or bound for North Korea or Iran must be treated as high-risk regardless of amount, and Ministerial Directives sit on top of the advisory: the Iran directive requires every such transaction to be reported to FINTRAC, and a separate directive applies the same high-risk treatment to Russia.
  • The "increased monitoring" list (the grey list) now runs to 21 jurisdictions, including Vietnam, Lebanon, Venezuela, Haiti and the British Virgin Islands. Algeria and Namibia came off the list.

Why this touches a dealership at all: the trigger is where the money comes from or goes, not who the client is. A wire from a foreign bank to settle a vehicle purchase, a lease buyout funded from an overseas account, an export deal with payment routed through a third country: each of those has a geography, and the advisory tells you which geographies FINTRAC expects you to treat differently. It is emphatically not about a client's nationality or passport; a Canadian resident paying from a Canadian account raises none of this.

Two practical consequences. First, transactions tied to listed countries are the kind of context that can turn "a bit odd" into reasonable grounds to suspect, and suspicious transaction reports have no dollar threshold. Second, your risk assessment is supposed to be a living document. One that hasn't been touched since it was written, while FINTRAC published two country-risk advisories this year, is exactly the kind of shelfware an examiner notices.

The test to run on yourself this week: pull any deal from the last year where the payment didn't come from a Canadian bank account, and check whether the file records where the funds actually came from. Then open your risk assessment and see if it says anything about what you do when that answer is a listed country. If either check fails, the fix is small and worth dating: a short geography section in the risk assessment, a note that it was reviewed against the July 15 advisory, and a habit of recording payment origin on every deal. Our free 12-item readiness checklist covers the risk-assessment gap alongside the rest of the program.

Sources: FINTRAC's July 15, 2026 advisory on financial transactions related to countries identified by the FATF, at fintrac-canafe.canada.ca. Country lists and directives change; verify against the current advisory or counsel before relying on this summary.